Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (48153 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-32967 1 Realtek 4 Rtl8111ep-cg, Rtl8111ep-cg Firmware, Rtl8111fp-cg and 1 more 2025-04-23 2.1 Low
RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system information such as serial number and server information.
CVE-2022-45758 1 Sens Project 1 Sens 2025-04-23 5.4 Medium
SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.
CVE-2022-45008 1 Online Leave Management System Project 1 Online Leave Management System 2025-04-23 4.8 Medium
Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_system/admin/?page=maintenance/department. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted payload injected into the Name field under the Create New module.
CVE-2022-44637 1 Redmine 1 Redmine 2025-04-23 6.1 Medium
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
CVE-2022-43668 1 Typora 1 Typora 2025-04-23 6.1 Medium
Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product.
CVE-2022-40242 1 Ami 1 Megarac Sp-x 2025-04-23 7.5 High
MegaRAC Default Credentials Vulnerability
CVE-2024-46494 1 Typecho 1 Typecho 2025-04-23 5.4 Medium
A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article.
CVE-2024-29392 1 Silverpeas 1 Silverpeas 2025-04-23 5.4 Medium
Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.
CVE-2024-33102 1 Thinksaas 1 Thinksaas 2025-04-23 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter.
CVE-2024-33101 1 Thinksaas 1 Thinksaas 2025-04-23 6.1 Medium
A stored cross-site scripting (XSS) vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the word parameter.
CVE-2024-33338 1 Jizhicms 1 Jizhicms 2025-04-23 7.3 High
Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.
CVE-2023-51254 1 Jfinalcms Project 1 Jfinalcms 2025-04-23 6.1 Medium
Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component.
CVE-2024-46410 1 Publiccms 1 Publiccms 2025-04-23 4.8 Medium
PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature
CVE-2022-44213 1 Zkteco 1 Automatic Data Master Server 2025-04-22 4.8 Medium
ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44031 1 Redmine 1 Redmine 2025-04-22 6.1 Medium
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields.
CVE-2022-34297 1 Yiiframework 1 Gii 2025-04-22 5.4 Medium
Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
CVE-2021-41943 1 Logrhythm 1 Logrhythm 2025-04-22 6.1 Medium
Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action -> Create a new Contextualize Action -> Inject your HTML tag in the name field.
CVE-2023-5307 1 Contest-gallery 1 Contest Gallery 2025-04-22 6.1 Medium
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.
CVE-2023-5238 1 Metagauss 1 Eventprime 2025-04-22 6.1 Medium
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
CVE-2023-5237 1 Strangerstudios 1 Memberlite Shortcodes 2025-04-22 5.4 Medium
The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.